A self-replicating attack known as ChainDropis hitting the npm registry, having so far infected 444 packages from more than a dozen publishers. The impact is massive, with the affected packages totaling more than 2 billion monthly downloads. The attack began with the compromise of a GitHub account belonging to Jared Wray, who maintains Keyv, a package with over 150 million weekly downloads that provides an interface for interacting with key-value stores across multiple backends.
See also: Mini Shai-Hulud Worm: Infects TanStack, Mistral AI and other Packages
Version 6.0.0 released around 9:00 UTC on Tuesday contained a new version of the credential-stealing Shai-Hulud malware.
The compromised account is also used to maintain several other popular packages, including cacheable, flat-cache, file-entry-cache, cacheable-request, cache-manager, ecto, and others. All of these had modified versions published. Shortly after, the attack expanded beyond this account, infecting packages from other organizations on npm — @deliveroo/reevent, @or-sdk/invitations, @picsart/ai-sdk, @qlik/embed-runtime, picasso.js, to name a few.
As of 18:10 UTC, StepSecurity had detected the malicious code in 444 packages and 2,212 versions. “Each poisoned version carries the same infection pattern: a preinstall dropper that downloads the legitimate Bun JavaScript runtime, and a 710KB disguised second stage that steals credentials, publishes more malicious packages, and infiltrates AI development tools,” researchers from StepSecurity said.
Although the code appears to be a new variant of Shai-Hulud — a supply chain credential-stealing worm that has plagued the npm and PyPI registries since last year in various variations — the researchers decided to call this new attack campaign ChainDrop because this new version uses the Ethereum blockchain for command and control, a technique known as EtherHiding.
“The breach was carried out by directly pushing malicious files to the master branch and then immediately forking a new version, meaning that the poisoned versions were published to npm with a valid origin signed by GitHub Actions,” researchers from Aikido Security in a report.
Wray confirmed via X that he uses OpenID Connect (OIDC) with npm and one-time codes for GitHub, so he wasn't using long-term static tokens. The developer regained access to his GitHub account around 20:00 UTC and said he was conducting a full audit. Malware infects AI code helpers The malicious files added to the packages are setup.mjs and Math_Symbol.js — renamed to math_init.js in some cases.
See also: 18 malicious npm packages deliver Cross-Platform RAT to Alibaba tools users
These are executed by a preinstall script during the npm installation process of packages and then proceed to download and execute a secondary disguised payload on the computer. The malware searches the local environment for cloud credentials, infrastructure secrets, developer access tokens, AI-related configuration files, and cryptocurrency wallets.
It also detects CI/CD workflows and build executors and attempts to hijack their memory for temporary secrets that are injected during the build process. New to this variant are the persistence mechanisms deployed within code editors like VS Code via tasks.json and AI code assistants like Claude Code via hooks.
“Targets for credential theft have expanded by nearly 70%, with new additions including AI-agent credential stores for Claude, OpenAI, Codex, Cursor, and Gemini; cryptocurrency stores for Foundry, Solana, and Monero; secrets of self-hosted CIs and registries such as Jenkins’ master.key, Argo CD, and Harbor; Alibaba Cloud and Tencent Cloud CLI configurations; and system files such as /etc/shadow,” researchers from security firm Wiz said in their analysis.
Unfortunately, enterprise security teams must perform full scans of developers' machines. Compromised packages are transitive dependencies for thousands of others, and if any of the poisoned versions were installed during the attack window, all possible credentials accessible to that machine, or other machines accessible from that machine, must be rotated.
Package managers like npm, pnpm, Yarn, and Bun now support minimum version age policies for installing packages. Configuring this setting between 3 and 7 days gives users some time in case a newly released version turns out to be poisoned. Security companies constantly scan and monitor the npm registry, and new compromises in the supply chain are usually discovered within minutes or hours.
See also: Infected joyfill npm packages: RAT is triggered on import in Node.js
🔑 Secure your passwords with Proton Pass
Password manager from Proton — end-to-end encryption, passkeys, built-in 2FA, and monitoring for leaks of your credentials.
- ✔ Encrypted storage of passwords & passkeys
- ✔ Notification if any of your passwords are leaked (Dark Web Monitoring)
- ✔ Free version — on all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
In this case, the malicious versions began to be removed by the npm team within two hours, but being a worm, the attack continues to spread through newly compromised developer accounts.
